Vibe Coding Checklist

Guide · Firebase · Checked against Firebase's docs, October 2026 · Updated

The Firebase launch checklist

Is my Firebase app ready for real users?

Not if your security rules are still in test mode. Test-mode rules let anyone read and write until a date written into the rule, and after that every request is denied. Replace them with rules that check who is signed in and what they own. The Firebase API key is fine in your app, but service account keys and Gemini API keys must stay secret.

Firebase is Google's backend for apps, and AI coding tools often set it up for you. That's a good foundation, but the security depends on rules and settings the AI may have left in test mode. Here are the ten things to check, where each lives in the Firebase console, and a prompt to give your AI.

Take the 2-minute checkJump to: before you launch
  1. 01

    Your data

    Firestore → Data

    Firestore has no fixed tables, so an AI can invent a new collection or field every time it hits a problem. Open the data viewer and make sure each collection matches something real in your app, and that the same thing isn't stored in two places.

    Paste into your AI

    Describe my Firestore data model in plain English: every collection, what one document holds, which fields point to other documents, and anything stored in two places. Flag anything you assumed instead of being told.

  2. 02

    Accounts

    Authentication → Settings

    Firebase turns on email enumeration protection by default for projects created on or after September 15, 2023, so sign-in errors don't reveal which emails have accounts. Check yours is on. Deleting a sign-in account doesn't delete that person's documents or files, so ask for both.

    Paste into your AI

    Walk me through every account flow: sign up, email verification, sign in, password reset, sign out and delete account. Which are missing? Make delete account remove the user's Firestore documents and Storage files too, not just their login.

  3. 03

    Permissions

    Authentication → custom claims

    A hidden button isn't a lock: your app talks to Firestore directly, so every rule has to live in your security rules or on a server. Roles like "admin" belong in custom claims, which Firebase says should only be set from a server with the Admin SDK. Never base a role on a field in the user's own document if they can edit it.

    Paste into your AI

    For every piece of private data and every admin action, show me the security rule or server check that enforces it. Where do roles like admin come from? Flag any role a user could change themselves, and anything only protected by hiding it in the UI.

  4. 04

    Database rules

    Firestore → Rules

    Test mode "allows anyone to read and overwrite your data" (Firebase's words). Its rule looks like allow read, write: if request.time < a date, which also means your app suddenly stops working when that date passes. Firebase warns that with open rules, anyone who guesses your project ID can steal, modify or delete your data. Replace them with rules for each collection.

    Paste into your AI

    Show me my Firestore security rules in plain English: for each collection, who can read, create, update and delete. Flag any rule that allows everyone, any if true, and any request.time date check left over from test mode. Then write tests for the rules with the Firebase emulator.

  5. 05

    API keys

    Project settings → General

    The apiKey in your Firebase config is fine to ship: Firebase says keys restricted to Firebase services identify your project but don't grant access. These must stay secret: service account private keys (Admin SDK), legacy FCM server keys, and any Gemini API key, which Firebase says should never be in your code. Put secrets for Cloud Functions in Secret Manager.

    Paste into your AI

    Search this project for API keys, service account JSON files and other secrets. For each one, tell me its name (not its value), what it unlocks, and where it's used. Anything other than the public Firebase config must move to Secret Manager or a server-side function.

  6. 06

    When things break

    Functions

    AI builds the happy path. Work that touches money or another service should run in a Cloud Function, where the server can finish or undo it if the person closes the app halfway. Firebase also warns that functions which trigger each other can loop forever and run up a bill.

    Paste into your AI

    For sign up, save, pay and upload: what happens if it fails halfway or the connection drops? Show me what the person sees, make sure retrying can't create duplicates or double charges, and check that no function can trigger itself in a loop.

  7. 07

    What leaves your app

    Authentication → Templates

    Firebase's Spark (free) plan caps auth emails per day: 1,000 verification emails, 150 password resets and just 5 email sign-in links. A launch can blow through those, and the emails just stop. The Blaze plan raises them a lot. Test notifications, webhooks and payments without reaching real people.

    Paste into your AI

    List everything this app sends out: auth emails, other emails, push notifications, payments, webhooks. For each, what triggers it, which plan limit applies, and how do I test it without reaching a real person or charging a real card?

  8. 08

    Uploads

    Storage → Rules

    Storage has its own security rules, separate from Firestore. A rule that doesn't check who's signed in makes those files public. Firebase's examples cap the size and type of uploads (for instance, images under 5 MB). Note: since February 3, 2026, Cloud Storage for Firebase requires the Blaze plan.

    Paste into your AI

    Show me my Storage security rules in plain English: who can upload, read and delete in each folder? Limit uploads by size and file type, and make sure people can only touch their own private files.

  9. 09

    Hosting and cost

    Usage and billing

    On the Blaze plan, budget alerts don't stop anything. Firebase says they "do not pause services." Spend cap budgets do pause a service for the rest of the month at 100%, but only for Firebase AI Logic, App Hosting, Cloud Functions and Extensions. Firestore doesn't back itself up; scheduled backups need Blaze and keep copies for up to 14 weeks.

    Paste into your AI

    Which Firebase plan is this project on, what does it cost per month at current usage, and what happens when I hit each limit? Which budget alerts or spend caps are set? Are Firestore backups scheduled, and how would I restore one?

  10. 10

    Knowing when it breaks

    Crashlytics, Usage dashboards

    Firebase's security checklist says to set up monitoring and alerts for Firestore, Realtime Database, Storage and Hosting. Crashlytics catches app crashes. But a backend can fail without crashing the app, so also add an outside check that does what a real user does every day, and track keys and domains that expire.

    Paste into your AI

    How would I find out right now if this app stopped working? Suggest a simple daily check that tests a real user action against Firebase, what alerts to set up, and list any keys, certificates or domains that will expire.

Before you launch

  1. Replace test mode rules. In Firestore, Realtime Database and Storage. Firebase recommends writing rules as you build and testing them with the Local Emulator Suite.
  2. Turn on App Check. It checks that requests come from your real app. Watch its metrics first, then turn on enforcement.
  3. Restrict your API keys. In the Google Cloud console, limit each key to the APIs and apps that use it. Use a separate key for anything that isn't Firebase.
  4. Set a budget alert, and a spend cap where you can. Also limit how many copies of each Cloud Function can run at once, so an attack or a loop can't scale your bill.
  5. Use a separate project for testing. Firebase recommends separate projects for development, staging and production, so a test never touches real users' data.

Newsletter · Free

Get the full Fix Kit, free.

For all ten items: a prompt to check your app, a prompt to fix it, and a way to confirm it worked yourself. Plus one new prompt every week.

Common questions

Is the Firebase API key safe to put in my app?

Yes, for Firebase services. Firebase says those keys only identify your project; access is controlled by security rules, App Check and IAM. Restrict the key to Firebase APIs. Service account keys, legacy FCM server keys and Gemini API keys are different and must stay secret.

What happens when Firestore test mode ends?

Test mode rules allow anyone to read and write until a date written into the rule. After that date, every request is denied and the app stops working. Before you launch, replace them with rules that check who is signed in and what they own.

Why aren't my Firebase emails arriving?

The Spark plan caps auth emails per day: 1,000 verification emails, 150 password resets and 5 email sign-in links. The Blaze plan allows far more. Check Authentication usage, and test with a real inbox, including spam.

Do Firebase budget alerts stop charges?

No. Firebase says budget alerts do not pause services. Spend cap budgets pause a service for the rest of the month at 100% of the budget, but only for Firebase AI Logic, App Hosting, Cloud Functions and Extensions.

Is this an official Firebase checklist?

No. It's an independent guide by Andrew Adams, based on Firebase's public documentation (checked October 2026), especially its security checklist. It isn't a professional security audit.

Sources

An independent guide, not affiliated with Firebase, and not a professional security audit. Dashboards change often; if a menu has moved, the prompts still work. Written by Andrew Adams, based on the Vibe Coding Checklist. Other guides: Lovable · Bolt · Cursor and Claude Code · Supabase · Firebase.